2. exploit client tor missconfig
3. repeat 1-2 until you have a net so wide of tor users that only node out is the service